Spring Security exclude url patterns in security annotation configurartion

Question

I have spring web application with Spring security configured using java config approach. I want to exclude some URL patterns from authentication(eg: static resources etc..). I have done this earlier with spring security xml config but couldn't figure out with java config as adding antmatchers doesn't help.

Following is my code added in security config class extending WebSecurityConfigurerAdapter

@Override public void configure(HttpSecurity http) throws Exception {     http.authorizeRequests()             .antMatchers("/authFailure")             .permitAll()             .anyRequest()             .authenticated()             .and()             .httpBasic()             .and()             .authenticationProvider(_provider)             .sessionManagement()             .sessionCreationPolicy(SessionCreationPolicy.STATELESS)             .and()             .addFilter(authFilter())             .addFilterAfter(executionContextFilter(),                     TokenBasedSecurityFilter.class).csrf().disable(); } 

The spring security version that I use is 3.2.0. Thanks in advance for helping

Edit:

The stacktrace that I got while hitting the excluded URL,

org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request     at com.inventory.ricemill.tba.spring.TokenBasedSecurityFilter.doFilter(TokenBasedSecurityFilter.java:59)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)     at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)     at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)     at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)     at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)     at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1041)     at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:603)     at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)     at java.lang.Thread.run(Thread.java:744)  Apr 01, 2014 10:18:41 PM org.apache.catalina.core.StandardWrapperValve invoke SEVERE: Servlet.service() for servlet [Inventory] in context with path [/ricemill] threw exception [Request processing failed; nested exception is org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request] with root cause org.springframework.security.authentication.AuthenticationServiceException: Authorization Header is not available in the request     at com.inventory.ricemill.tba.spring.TokenBasedSecurityFilter.doFilter(TokenBasedSecurityFilter.java:59)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:110)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:57)     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)     at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)     at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)     at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)     at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:343)     at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:260)     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:100)     at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)     at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1041)     at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:603)     at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:310)     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)     at java.lang.Thread.run(Thread.java:744) 

The request goes through the filters registered in spring security filter chain, while it shouldn't as the request is ignored with antmatcher

Answer 1

Found the solution in Spring security examples posted in Github.

WebSecurityConfigurerAdapter has a overloaded configure message that takes WebSecurity as argument which accepts ant matchers on requests to be ignored.

@Override public void configure(WebSecurity web) throws Exception {     web.ignoring().antMatchers("/authFailure"); } 

See Spring Security Samples for more details